Possibility to explicit remove Serialization support for a lambda

by

How to handle serializability was one of the biggest challenges for the EG; suffice it to say that there were no great solutions, only tradeoffs between various downsides. Some parties insisted that all lambdas be automatically serializable (!); others insisted that lambdas never be serializable (which seemed an attractive idea at times, but sadly would badly violate user expectations.)

You note:

Well, another solution is to never use lambda expressions/method references in security relevant code,

In fact, the serialization spec now says exactly that.

But, there is a fairly easy trick to do what you want here. Suppose you have some library that wants serializable instances:

public interface SomeLibType extends Runnable, Serializable { }

with methods that expect this type:

public void gimmeLambda(SomeLibType r)

and you want to pass lambdas into it, but not have them be serializable (and take the consequences of that.) So, write yourself this helper method:

public static SomeLibType launder(Runnable r) {
    return new SomeLibType() {
        public void run() { r.run(); }
    }
}

Now you can call the library method:

gimmeLambda(launder(() -> myPrivateMethod()));

The compiler will convert your lambda into a non-serializable Runnable, and the laundering wrapper will wrap it with an instance that satisifies the type system. When you try to serialize it, that will fail since r is not serializable. More importantly, you can’t forge access to the private method, because the $deserializeLambda$ support that’s needed in the capturing class won’t even be there.

More Related Contents:

  1. How to serialize a lambda?
  2. What is the difference between a lambda and a method reference at a runtime level?
  3. Unable to deserialize lambda
  4. What are functional interfaces used for in Java 8?
  5. Why filter() after flatMap() is “not completely” lazy in Java streams?
  6. How to force max to return ALL maximum values in a Java Stream?
  7. What is the equivalent lambda expression for System.out::println
  8. Copy a stream to avoid “stream has already been operated upon or closed”
  9. Does a lambda expression create an object on the heap every time it’s executed?
  10. Java 8 Nested (Multi level) group by
  11. Precise definition of “functional interface” in Java 8
  12. How to get the MethodInfo of a Java 8 method reference?
  13. Java 8: Difference between method reference Bound Receiver and UnBound Receiver
  14. Group by and sum objects like in SQL with Java lambdas?
  15. Lambda expression vs method reference
  16. Java 8 Lambda Expressions – what about multiple methods in nested class
  17. Lambda this reference in java
  18. java.lang.ClassCastException using lambda expressions in spark job on remote server
  19. Java 8: Where is TriFunction (and kin) in java.util.function? Or what is the alternative?
  20. Java lambda returning a lambda
  21. How do I use the new computeIfAbsent function?
  22. How to get a range of items from stream using Java 8 lambda?
  23. Local variable log defined in an enclosing scope must be final or effectively final
  24. Java 8: Mandatory checked exceptions handling in lambda expressions. Why mandatory, not optional?
  25. Java access bean methods with LambdaMetafactory
  26. What kind of List does Collectors.toList() return?
  27. Java 8 Filter Array Using Lambda
  28. Lambdas in the classical Operation enum example
  29. Cannot use Java 8 method with lambda arguments without specifying type arguments
  30. Creating String representation of lambda expression [duplicate]

Leave a Comment